Distributed detection of security threats in a remote network management platform

Patent metadata

Field	Value
Publication number	US-11240271-B2
Application number	US-201816191113-A
Country	US
Kind code	B2
Filing date	Nov 14, 2018
Priority date	Nov 14, 2018
Publication date	Feb 1, 2022
Grant date	Feb 1, 2022

Abstract

A system may include a plurality of computational instances dedicated to different managed networks and a central instance communicatively coupled to the plurality of computational instances. A first computing device disposed within a first computational instance may be configured to: obtain a profile of a software application operational within a first managed network to which the first computational instance is dedicated, calculate a threat level of the software application based on the profile, determine that the threat level exceeds a pre-determined threshold, and transmit, to the central instance, an indication that the threat level exceeds the pre-determined threshold. A second computing device disposed within the central instance may be configured to: receive the indication, determine that the software application is also operational within a second managed network to which a second computational instance, and transmit, to the second computational instance, an indication that the threat level exceeds the pre-determined threshold.

First claim

What is claimed is:

1. A remote network management platform comprising:
a plurality of computational instances dedicated to different managed networks, wherein each of the computational instances is configured to receive information regarding the operation of client computing devices of a respective managed network to which the computational instance is dedicated, and wherein each of the plurality of computational instances contains one or more respective computing devices; and
a central instance communicatively coupled to the plurality of computational instances, wherein the central instance is not dedicated to any of the managed networks, and wherein the central instance contains one or more central computing devices;
wherein a first computing device disposed within a first computational instance of the plurality of computational instances is configured to: obtain a profile of a software application operational on a first client computing device of a first managed network to which the first computational instance is dedicated, calculate a threat level of the software application based on the profile, determine that the threat level of the software application exceeds a pre-determined threshold threat level, and transmit, to the central instance, an indication that the threat level of the software application exceeds the pre-determined threshold threat level; and
wherein a second computing device disposed within the central instance is configured to: receive the indication that the threat level of the software application exceeds the pre-determined threshold threat level, determine that the software application is also operational on a second client computing device of a second managed network to which a second computational instance of the plurality of computational instances is dedicated, and transmit, to the second computational instance, a further indication that the threat level of the software application exceeds the pre-determined threshold threat level, wherein the first managed network and the second managed network are operated by different clients of the remote network management platform.

2. The remote network management platform of claim 1 , wherein the profile includes one or more of: a name of the software application, a name of a file used by the software application, a size of the file used by the software application, a checksum of the file used by the software application, a processor utilization attributed to the software application, or an amount of network traffic attributed to the software application.

3. The remote network management platform of claim 1 , wherein the first computing device is further configured to:
anonymize the profile by omitting or obscuring any information therein that is usable to identify the first managed network or the first computational instance; and
transmit, to the central instance, the profile as anonymized.

4. The remote network management platform of claim 1 , wherein calculating the threat level of the software application comprises:
looking up the software application in a database of software applications; and
obtaining at least one factor influencing the threat level from the database of software applications.

5. The remote network management platform of claim 1 , wherein the second computing device is further configured to:
obtain, from a third computational instance of the plurality of computational instances, an indication that the software application was classified as a threat by a third managed network to which the third computational instance is dedicated; and
based on the software application being classified as the threat by the third managed network, increase the threat level of the software application.

6. The remote network management platform of claim 1 , wherein the first computing device is further configured to:
determine a number of the client computing devices of the first managed network on which the software application is operational,
wherein calculating the threat level of the software application is further based on the number of the client computing devices of the first managed network on which the software application is operational.

7. The remote network management platform of claim 1 , wherein the first computing device is further configured to:
provide, for display on a graphical user interface of a third client computing device of the first managed network, a color-coded heat map of a plurality software applications operational on the client computing devices of the first managed network,
wherein, for each of the client computing devices of the first managed network on which the software application is operational, the color-coded heat map represents the software application with a first color representing that the software application exceeds the pre-determined threshold threat level.

8. The remote network management platform of claim 7 , wherein a further software application operational on the first client computing device of the first managed network does not exceed the pre-determined threshold threat level, and wherein the color-coded heat map represents the further software application with a second color representing that the further software application does not exceed the pre-determined threshold threat level.

9. The remote network management platform of claim 7 , wherein the first computing device is further configured to:
receive, by way of the graphical user interface, a selection of the representation of the software application in the heat map; and
in response to receiving the selection, provide, for display on the graphical user interface, a textual description of one or more threats associated with the software application.

10. The remote network management platform of claim 1 , wherein the threat level of the software application is specific to a particular industry, wherein the first managed network and the second managed network are associated with the particular industry, and wherein transmitting, to the second computational instance, the further indication that the threat level of the software application exceeds the pre-determined threshold threat level is based on the second managed network being associated with the particular industry.

11. A computer-implemented method of operating a remote network management platform, comprising:
hosting a plurality of computational instances of the remote network management platform, wherein each computational instance is configured to receive information regarding the operation of client computing devices of a respective managed network to which the computational instance is dedicated, and wherein each computational instance is communicatively coupled to a central instance of the remote network management platform;
obtaining, via a first computational instance, a profile of a software application operational on a first client computing device of a first managed network to which the first computational instance of the remote network management platform is dedicated;
calculating, via the first computational instance, a threat level of the software application based on the profile;
determining, via the first computational instance, that the threat level of the software application exceeds a pre-determined threshold threat level;
determining, via the central instance, that the software application is also operational on a second client computing device of a second managed network to which a second computational instance of the remote network management platform is dedicated, wherein the first managed network and the second managed network are operated by different clients of the remote network management platform; and
transmitting, from

Assignees

• Servicenow Inc

Inventors

• Wiener David Joshua
• Pinchovski Barak
• Yariv Nir

Classifications

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• G06N5/01

  Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound · CPC title

• G06N3/09

  Supervised learning · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title